name: ci-pangolin

# 触发条件:deploy/ 或 design/ 或 ci/ 变更时，以及所有向 main 的 PR
on:
  push:
    branches: [main]
    paths:
      - 'deploy/**'
      - 'design/**'
      - 'ci/**'
      - '.gitea/workflows/ci.yml'
  pull_request:
    branches: [main]
  workflow_dispatch:

jobs:

  # ── Job 1: Lint (shellcheck) ─────────────────────────────────────────────
  lint:
    name: Lint — shellcheck
    runs-on: nas
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: shellcheck deploy/scripts/*.sh
        run: |
          docker run --rm \
            -v "$PWD/deploy:/mnt/deploy:ro" \
            koalaman/shellcheck:stable \
            shellcheck -S warning \
              /mnt/deploy/scripts/gen-secrets.sh \
              /mnt/deploy/scripts/print-clients.sh \
              /mnt/deploy/scripts/deploy.sh \
              /mnt/deploy/scripts/cutover.sh \
              /mnt/deploy/scripts/rollback.sh

      - name: shellcheck deploy/edge/pangolin-entrypoint.sh
        run: |
          docker run --rm \
            -v "$PWD/deploy/edge:/mnt/edge:ro" \
            koalaman/shellcheck:stable \
            shellcheck -S warning /mnt/edge/pangolin-entrypoint.sh

  # ── Job 2: Unit Tests ────────────────────────────────────────────────────
  unit-test:
    name: Unit Tests — nginx cfg + compose
    runs-on: nas
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: validate docker-compose.yml (syntax)
        run: docker-compose -f deploy/docker-compose.yml config -q

      - name: nginx config lint with stub certs
        run: bash ci/nginx-test.sh

  # ── Job 3: OpenAPI Sync Check ────────────────────────────────────────────
  openapi-check:
    name: OpenAPI Sync Check
    runs-on: nas
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      # openapi-spec-validator 是纯 Python、无外部依赖，校验 OAS 3.0 结构合法性。
      - name: lint design/server/openapi.yaml
        run: |
          docker run --rm \
            -v "$PWD/design/server:/spec:ro" \
            python:3.12-alpine \
            sh -c "pip install openapi-spec-validator --quiet && \
                   python -m openapi_spec_validator /spec/openapi.yaml"

  # ── Job 4: Redline Word Scan (脱敏) ──────────────────────────────────────
  redline-scan:
    name: Redline Scan — 脱敏 (UI 文案)
    runs-on: nas
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: scan UI text resources for prohibited words
        run: bash ci/scan-redline.sh

  # ── Job 5: Container Image Build ────────────────────────────────────────
  image-build:
    name: Image Build — pangolin-edge
    runs-on: nas
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - name: build pangolin-edge:ci
        run: docker build -t pangolin-edge:ci ./deploy/edge